Who we are
CalChopAI is the data controller for the information described here. You can reach us about anything on this page at
[email protected].
What we collect
Account details — your email address and password. Passwords are hashed by our authentication provider; we never see or store the plain text.
Profile and goals — name, and any of age, sex, height, weight, activity level and target you choose to enter. These are used to work out your daily calorie and macro targets. You can leave them blank.
Meals you log — the dish, its portion, and the calories, protein, carbs and fat attached to it, with the date and time.
Meal photos — the pictures you take to scan a plate, stored with the entry they belong to so you can look back at them.
Other logs — water, weight, and exercise entries, if you use those features.
Group activity — if you join or create a group, the members of that group can see your name and the progress you share into it.
Scan usage: a timestamped record of each AI scan you make. This exists only to apply the daily scan limit to accounts without an active plan. It records that a scan happened, not what was in it.
Subscription status — which plan you are on and when it renews or expires.
Device notification token — only if you turn on tracking reminders.
Support messages: what you write to us from Help & Support in the app, and our replies, kept with your account so the conversation is there on any device. Only our support team can read them, and deleting your account deletes them.
What we do not collect
We do not collect your location.
We do not collect your contacts.
We do not track you across other apps or websites, and there are no advertising trackers in CalChopAI.
Your meal photos, specifically
This is the part people most want a straight answer on, so here it is.
When you scan a plate, the photo is sent to our AI provider, Anthropic, which returns an estimate of what the food is and what is in it. The photo is sent for that purpose and that purpose only. Under our agreement with them it is not used to train their models.
The photo is then stored with your log entry so the meal has a picture attached when you scroll back. Deleting the entry deletes the photo. Deleting your account deletes all of them.
Your photos are never shown to other users, never published, and never sold.
Why we are allowed to hold it
Under the Nigeria Data Protection Act 2023, and under UK/EU GDPR if you are outside Nigeria, we rely on two grounds. Most of your data we hold because it is necessary to perform the contract you entered into when you created an account — you asked for a food tracker, and a food tracker without your meals in it does not exist.
Health-related information gets stricter treatment. What you eat, your weight, and your fitness goals are treated as sensitive personal data, and we rely on your explicit consent, given when you create an account and enter it. You can withdraw that consent at any time by deleting the data or your account.
If you connect Apple Health, CalChopAI reads your active energy, steps and workouts on your iPhone only, to add burned calories back to your daily goal. None of it is uploaded to our servers or shared; the health data policy has the details.
Who we share it with
We do not sell your personal data. We have never done so and the business does not depend on it.
We share data with a small number of processors who provide the service, and only what each of them needs:
Anthropic — receives meal photos you choose to scan, in order to analyse them.
Supabase — our database and authentication provider, which stores your account and logs.
Apple and Google — handle subscription payments. They tell us whether your subscription is active. We never see your card details.
Expo — delivers push notifications, if you have turned reminders on.
Members of any group you join — see the progress you share into that group.
Where your data goes
Our providers operate internationally, so your data may be processed outside Nigeria, including in the United States and the European Union. Where that happens we rely on the transfer safeguards in our agreements with each provider. If you are in the UK or EU, standard contractual clauses apply.
How long we keep it
Your log stays until you delete it or delete your account — the point of a tracker is being able to look back, so we do not quietly expire your history.
Delete an entry and it goes, along with its photo. Delete your account and everything attached to it goes, including your logs, photos and profile. Backups are cycled out within 30 days.
We keep basic records of subscription transactions for as long as tax and accounting law requires, because we are not allowed to delete those on request.
Your rights
Whether you are covered by the NDPA 2023 or by GDPR, you have the right to get a copy of your data, correct it, delete it, restrict or object to how we use it, take it elsewhere in a portable form, and withdraw consent.
Two of those you can exercise yourself, immediately, without asking us: you can export your log, and you can delete your account and its contents from inside the app. We built it that way deliberately. For anything else, write to
[email protected] and we will respond within 30 days.
If you think we have handled your data badly, you can complain to the Nigeria Data Protection Commission, or to your local supervisory authority if you are in the UK or EU. We would rather you told us first so we can fix it.
Security
Data is encrypted in transit and at rest. Access to production data is limited to the people who need it to run the service. Our database enforces row-level security, which means the rules about who can read which rows are applied by the database itself rather than trusted to application code.
No system is perfect. If we ever suffer a breach that puts you at risk, we will tell you and the relevant regulator, as the law requires.
Children
CalChopAI is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has created an account, tell us and we will remove it.
Changes
If we change this policy in a way that materially affects you, we will tell you in the app before it takes effect rather than silently updating this page.